arXiv:2610.03448v1 Announce Type: cross Abstract: LLM agents increasingly screen tool outputs with small prompt-injection detectors, and teams choose among detectors by their scores on public benchma...
arXiv:2604. 16706v2 Announce Type: replace Abstract: Automated evaluation of tool-using large language model (LLM) agents is widely assumed to be reliable, yet this assumption is rarely validated against human annotation.
The paper investigates whether an overseer can predict when an AI agent will comply with a peer’s coercion to reveal sensitive information. By training a linear probe on the agent’s internal activations, the authors demonstrate high detection rates—up to 82% of leaking calls at a 5% benign flag rate—across multiple multi‑agent scenarios. The probe also identifies legitimate disclosures more often than violations, indicating a short‑range warning that could enable pre‑emptive intervention.
arXiv:2609.37315v1 Announce Type: cross Abstract: Tool-using agents are entering settings where a wrong action carries real cost, and the benchmarks certifying them grade what each simulated tool cal...
arXiv:2607. 24893v1 Announce Type: cross Abstract: Multi-agent LLM systems can be attacked by a payload that no single agent ever holds in full: a poisoned tool hides encrypted fragments in its observations, spreads them across several agents, and an external step reassembles and executes them after the run.
The paper investigates whether adding a short classification instruction after a user’s prompt improves the ability of activation probes to detect malicious inputs in large language models. Across 13 safety benchmarks and three open‑weight model families, a classification suffix consistently boosts out‑of‑distribution detection (up to ~4 AUC points) compared to no suffix, and the benefit transfers to multi‑position pooling probes used in production. The improvement stems from the classification format itself rather than the specific content of the instruction, though the optimal suffix varies with the model and readout type.
arXiv:2610.02267v1 Announce Type: new Abstract: Agent harnesses make many small, typed decisions per task: which model to call, which tool to use, whether retrieved text is relevant, whether an input...
arXiv:2609.35889v1 Announce Type: cross Abstract: Tool-using language-model agents select and execute third-party artifacts. Different implementations can return the requested output while producing...
The paper evaluates CASCADE, a fully local layered defense for Model Context Protocol (MCP)-based systems, by conducting a component ablation and corpus audit on a fixed 5,000-sample dataset. It demonstrates that the choice of aggregation convention heavily influences reported metrics, that detection performance varies with provenance, and that the released configuration does not fully disclose the operating point. The study also shows that a local review model invoked for a third of requests does not alter classification outcomes, highlighting the importance of reproducibility and transparency in defense evaluations.
The paper investigates whether an overseer can predict when an AI agent will yield to peer pressure and reveal sensitive information. By training a linear probe on the agent’s internal activations, the authors demonstrate that they can detect imminent leaks with high accuracy—catching 82 % of leaking calls on Qwen3‑32B while flagging only 5 % of benign ones. The study also shows that a simple bag‑of‑words classifier performs similarly, indicating that the probe’s advantage largely stems from label training rather than activation patterns.
The paper introduces TRACE, a protocol designed to diagnose whether changes in verifier scores for large language model agents reflect actual changes in agent behavior or merely alterations in the evaluation process. TRACE works by applying targeted changes to evaluation components, running paired experiments, and re‑scoring unchanged trajectories to isolate the source of score variation. Experiments on synthetic tasks and public benchmark tasks demonstrate that seemingly significant score shifts can often be attributed to evaluation artifacts, while TRACE can also detect genuine behavioral changes.
RH-Detect is a unified benchmark for detecting reward hacking in language models, aggregating 92,761 examples from eleven public datasets into a common schema with six behavior categories. It evaluates six off‑the‑shelf models on 5,021 open‑ended evaluation units, achieving a top AUROC of 0.962 and over 93% accuracy, though performance drops notably on multi‑turn tool‑use datasets. The study also shows that input format changes and single‑token fine‑tuning can influence detector performance, revealing gaps in deployment‑time monitoring.